Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59489
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 54906 invoked from network); 9 Apr 2012 08:35:51 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 9 Apr 2012 08:35:51 -0000
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.161.170 mail-gx0-f170.google.com  
Received: from [209.85.161.170] ([209.85.161.170:41528] helo=mail-gx0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 32/EF-56433-66F928F4 for <internals@lists.php.net>; Mon, 09 Apr 2012 04:35:50 -0400
Received: by ggmb2 with SMTP id b2so1979363ggm.29
        for <internals@lists.php.net>; Mon, 09 Apr 2012 01:35:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:sender:in-reply-to:references:from:date
         :x-google-sender-auth:message-id:subject:to:cc:content-type;
        bh=Ecz8b8upgA8nOt5Gnvhaak8Ad7Pu6tWEDTQo9tjSkXM=;
        b=HUgttBj6AgrH47DzMtZIXdH6CozYwIVpH0/tHEZqjrs3l5gIAFUTiwKKX17NywBcWr
         eVebuYXkfFYYCnikpUTQwrCC4Dqj6U+g1GP58LddA/D9h3AXz/xC6t5bZqM2SekV0D7R
         iu1DQR9jvLnLYazqmAC8CBHnRE4+qiddPNK8NDVpc16MbWQoe7Se4l9l/Se9E3q08Tcp
         rmt+Oxsdj5epryw1EDiep9nuw4FlDVxl6uWYOW2rC8Fi4RB8B2QnsR6uCrKbx8pygdZK
         OAyWfx6iVDpSTqnFiPqQ4RQk7rb8l054JMSenC5a37oXxLkdvh/NrTE4JJ0hu8Xdeey6
         ehXQ==
Received: by 10.236.190.42 with SMTP id d30mr5081103yhn.77.1333960547810; Mon,
 09 Apr 2012 01:35:47 -0700 (PDT)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.146.86.14 with HTTP; Mon, 9 Apr 2012 01:35:07 -0700 (PDT)
In-Reply-To: <CAL0xaBGGFRqq9tkc33daKoqTNHsLNmgadkUEjJtrGGJsWfK+YQ@mail.gmail.com>
References: <CAORXhGLk8=bJ2TEo0OCzQCacjtGG=ZWYNuXf8Uu8oMNEm2WQ1A@mail.gmail.com>
 <CAGa2bXYP0kNA5PyvmdjoHZO91t8AojG9FjUe4nbCHhGjn2=MPg@mail.gmail.com>
 <4F80C739.2060404@gmail.com> <CAGa2bXZSgV3bRPGMt6Esw16v3ErVMLVQy1fb8cZxdc=OokpXKg@mail.gmail.com>
 <CAL0xaBEpjhwTMFknx9nPYXqFGOqM9f2xRiBhcdb8NtPCsVL6sg@mail.gmail.com>
 <CAGa2bXaEZ1rkkQ1MTCQ8=eet9P9oAWXz-cPMe5wRhHfFJE8N8Q@mail.gmail.com>
 <CAORXhG+eg8kS9Xqyt4WdH0H5C6H5P09Uc9+U5LA0RWrs5iR5ow@mail.gmail.com>
 <CAGa2bXbtJ3ksL_iaeZ0+DGU5veKegNRS0LY1s=zrZVNwLLvt7Q@mail.gmail.com> <CAL0xaBGGFRqq9tkc33daKoqTNHsLNmgadkUEjJtrGGJsWfK+YQ@mail.gmail.com>
Date: Mon, 9 Apr 2012 17:35:07 +0900
X-Google-Sender-Auth: riGgJOReDpSSid2qF8ogKBo06k8
Message-ID: <CAGa2bXZa=DS0YS2aL5nobGZif23qbCcAMQMaagdG2-HFffCiVg@mail.gmail.com>
To: Arvids Godjuks <arvids.godjuks@gmail.com>
Cc: PHP Internals <internals@lists.php.net>, Tom Boutell <tom@punkave.com>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] PHP class files without <?php at the top
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

2012/4/9 Arvids Godjuks <arvids.godjuks@gmail.com>:
> And you get same issues that existed with magic quotes, register variables,
> safe mode and other optional stuff that was required to run application when
> set specificaly and it would break if something set differently. PHP just
> got rid of it and you want to introduce a new optional feature that will
> change how PHP behaves.

Magic Quotes is broken by design.
Register Globals may work but erroneous.
Safe Mode was great for fail safe, but it was misunderstood.
Therefore, they are removed.

All of these are security related changes why not for
mandatory  embed mode?

There were full of embedded PHP pages 10 years ago.
Only template pages require embedded PHP script now.

There is no compatibility issue for current code.
New code that adopts non-embed scripting will enjoy
better security than now.

Embed w/o option would be the last existing PHP feature
that other language programmers may call "PHP is insecure
than my language" IMO

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net